UpHeron
All vulnerabilities

Servers and applications · WordPress plugins

CVE-2023-5982

UpdraftPlus: WP Backup & Migration Plugin: Cross-Site Request Forgery (CSRF)

Severity
Medium 5.4
Published
7 Nov 2023
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
1.23.11
Also known as
WPV-a11ef97193aa
Sources
NVD, WPVulnerability

Description

The UpdraftPlus: WordPress Backup & Migration Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.23.10. This is due to a lack of nonce validation and insufficient validation of the instance_id on the 'updraftmethod-googledrive-auth' action used to update Google Drive remote storage location. This makes it possible for unauthenticated…

Affected software

SoftwareAffected versions
UpdraftPlusServers and applications · cpe:a:updraftplus:updraftplus
  • Every version up to 1.23.10
UpdraftPlusWordPress plugins · wp-plugin:updraftplus
  • Every version before 1.23.11

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-5982
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-5982
  • Wordfence https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/updraftplus/updraftplus-12310-cross-site-request-forgery-to-google-drive-storage-update